Proxy server and work servers 155.247.166.219 & .220

[Nekolepsy]

Most of my f@h nodes use a squid web proxy to communicate with f@h. It has been working, except I would get "Exception: 10001: Server responded: HTTP_GATEWAY_TIME_OUT" errors when these nodes would get assigned to work server 155.247.166.219 or 155.247.166.220 . The nodes will then try again or get assigned to a different server. Sometimes this means they will retry connecting to one of these servers over and over. The unconfigurable connection backoff mechanism will attempt a new connection after a few seconds, then minutes, then hours, sometimes leaving the nodes idle for long periods of time. This occurred on the majority of my nodes early Sunday morning. Tracing the problem, I found that the connection port specifier is not being passed to the proxy server. That means that when sending the request to the proxy it will come in as "POST http ://155.247.166.219/" instead of "POST http ://155.247.166.219:8080/" like it should since these two servers only listen on port 8080. I managed a work around with iptables on the proxy server:

Code: Select all

iptables -t nat -A OUTPUT -d 155.247.166.219/32 -p tcp -m tcp --dport 80 -j DNAT --to-destination 155.247.166.219:8080
iptables -t nat -A OUTPUT -d 155.247.166.220/32 -p tcp -m tcp --dport 80 -j DNAT --to-destination 155.247.166.220:8080

Obviously this shouldn't be required in the first place.

[bruce]

Yes, we understand that limitation. If you look at http://fah-web.stanford.edu/pybeta/serverstat.html you'll find that most servers show a "0" in the column with the title "80" indicating that port 80 is redirected to port 8080 on the server. Those servers with are red in that column are not accepting connections on port 80.

There are two reasonable fixes, for this problem (plus the one you suggest) ... both require action by a PG administrator.
1) Re-enable the redirection in the server's iptables.
2) Fix whatever code was once in place to assign download requests coming to the Assignment Server from port 80 to redirect you directly to a server which is accepting connections on port 80.
3) Ask others in your predicament to do something like you've done. (While I appreciate your efforts, I think it's unreasonable for PG to expect others to find such a solution.)

I'll contact the owner of those two servers and ask them to use option 1.

I'll also search for, and if necessary compose a new ticket for fix #2.

EDIT: #2 completed. See https://github.com/FoldingAtHome/fah-issues/issues/1208

[vvoelz]

Thanks Bruce for bringing this to our attention.

We are aware of this problem (which is due to an institutional firewall issue at Temple) and are working to fix it. Our servers (155.247.166.219 & .220) are currently under a security review at Temple to open up port 80. We will also have to install some new software on our servers to be security-compliant. Hopefully we'll fix this soon -- we'll let you know. --VInce